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Like all of quantum information theory, quantum cryptography is tradi- 
tionally based on two level quantum systems. In this letter, a new protocol for 
quantum key distribution based on higher dimensional systems is presented. 
An experimental realization using an interferometric setup is also proposed. 
Analyzing this protocol from the practical side, one finds an increased key 
, creation rate while keeping the initial laser pulse rate constant. Analyzing 

iy-\ I it for the case of intercept/resend eavesdropping strategy, an increased error 

0^ ' rate is found compared to two dimensional systems, hence an advantage for 

Q ' the legitimate users to detect an eavesdropper. 
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I 1 Introduction 
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C, 

^ , Reliable transfer of confidential information is becoming more and more 

qh| important. The only means, mathematically proven to be secure, is the 

One Time Pad |jl|, in which the sender, Alice, and the receiver. Bob, 
need to share a common secret key. This key is used to en- and de- 
code the secret message. Quantum key distribution (QKD) is known to 
complement the One Time Pad to a secure system 0. Based on the 
non-classical features of quantum mechanics, it provides the distribution 
of the key in a way, that guarantees the detection of any eavesdropping. 
Roughly speaking, since it is not possible to measure an unknown quan- 
tum system without modifying it, an eavesdropper manifests itself by 
introducing errors in the transmission data. After the final transmis- 
sion, a suitable subset of data is used to estimate the error rate. If the 
error rate is found to be below a certain threshold, Alice and Bob can 
proceed using the remaining data to establish a secret key by means of 
error correction and privacy amplification [^. Otherwise they will decide 
that the data are not secure and start a new data transmission. 

During the last years several quantum key distribution protocols 
based on two-level systems (qubits) have been published Q, 0. The 
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connection between the quantum bit error rate QBER and the maximum 
amount of information the eavesdropper might have attained has been 
investigated both in the case of incoherent and coherent (joint measure- 
ment of more qubits) eavesdropping attacks P, |], and the shortening of 
the raw key due to error correction and privacy amphfication has been 
calculated [0. There is one interesting thing to note: all work, not only 
in the case of quantum key distribution but in quantum information the- 
ory in generally, has this far mainly been based on qubits (for exceptions, 
see e.g. ^j). The reason is probably easy but not very scientific: classical 
information theory is based on bits. Indeed, the enlargement to higher 
alphabets is of no interest in the classical case since it does not hold any 
advantage. 

From the experimental side, a number of prototypes, based on qubits, 
have been developed, demonstrating that QKD not only works inside 
the laboratory, but outside - under real conditions - as well 0. Thus 
quantum key distribution together with the One Time Pad, could already 
today provide an alternative to the traditional public key systems where 
security is based on computational complexity, which may turn out to be 
insecure. However, using present technology, the prototypes, especially 
those, adapted to "long" transmission distances of tens of kilometers, 
still suffer from low key creation rates of some hundred Hz. This could 
be improved by a factor of ten by sending single photon Fock states 
instead of faint laser pulses (containing only 0.1 photon per pulse), and 
by increasing the initial pulse rate, however, the drawback being more 
and more severe technical demands. 

In this article, we propose a new QKD protocol using a larger al- 
phabet and analyze it in terms of key creation rate and security against 
eavesdropping. Surprisingly and in opposition to the classical treatment 
of information, we find some important differences when passing from 
the two- to the higher dimensional case. Since each photon carries more 
information, we find an increase of the flux of information between Alice 
and Bob while keeping the initial pulse rate constant. Beyond and even 
more important, a first eavesdropping analysis considering the strategy 
of intercept /resend shows advantages of this new protocol with respect 
to protocols based on qubits. 

The paper is arranged in the following way: In section 2, we intro- 
duce our new proposal and investigate it in terms of security against 
eavesdropping. After this theoretical part, we present an experimental 
realization (section 3) and discuss some further extensions of our idea 
(section 4). Finally, a short conclusion is given in section 5. 



2 Quantum key distribution using larger 
alphabets 

Higher-dimensional quantum systems have aheady been investigated in 
order to generahze tests of local realism or in the context of the Kochen 



Specker theorem ( [p^ |rT| and references therein). However, up to now, 
like its classical counterpart, quantum information theory has essentially 
been based on bits (qubits). 

Here we investigate the use of higher spins for QKD. One can imagine 
a whole variety of new protocols. For example using n non-orthogonal 
states, where n is the dimension of the space. However the state iden- 
tification becomes more and more difficult since it has to be done with 



POVM-measurements |T^. Another possibility is using m different bases, 
each with n orthogonal states, where n is the dimension of the space. In 
this first approach we will limit ourselves to a protocol, using two bases 
and four orthogonal states per basis. 

2.1 QKD : BB84 in four-dimensions 

The protocol known as the BB84, is originally intended for two bases, 
each one with two orthogonal states (qubits), but it may without diffi- 
culty be extended to a four-level system or the so called quantum quarts 
(qu-quarts). As in the qubit case, Alice first chooses in which of two 
bases she wants to prepare her state, and second she has to decide which 
state to send. In the qu-quart case Alice has to chose between four dif- 
ferent states, whereas in the qubit case she has to chose between two 
different states. Each of the two bases are chosen with equal probability, 
and each state is again chosen with equal probability. In other words, in 
the four-dimensional case, each of the possible eight states appear with 
probability 1/8, whereas, in the traditional two-dimensional case, the 
probability is 1/4. 

The first basis can always be chosen arbitrarily as 

I V'a),|^/3),|V'7)J ^"5), (1) 

where the states satisfy \{'ipi\'ipj)\ = Sij The second basis has to ful- 
fill a certain requirement with respect to the first basis, namely that 
K V^i I 0j )| = 1/2. This requirement makes the protocol symmetric which 
insures that the eavesdropper is not given any advantage. There are 
several choice of bases which may fulfill this requirement, but in the 
following the basis is assumed to be 



^a ) = |( I V^a ) + I ^/3 ) + I V^7 ) + I ^5 ) ) 
^/3 ) = |( I ^a ) - I V^/3 ) + I ^7 ) - I V^5 ) ) 
^-f) = m^a) -\1P13) -\lp^) + \lps)) 
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These states satisfy \{<t>i\(t>j)\ = Sij. Furthermore the overlap between 
any state from the first {ip-) basis with any state from the second (0-) 
basis is seen to be | as required. 

Bob will every time he receives a state chose to measure either in the 
ip- or the 0- basis. At the end of all the transmissions Alice and Bob 
will — as in the qubit case — have a public discussion where they single 
out the transmission where they have used the same basis. Since they 
both make random choices on average 1/2 of the transmission have to 
be discarded. If no eavesdropper is present Alice and Bob will now share 
a random string of a, (3, 7 and (5's, where the various letters are taken 
to be the subscript of the states, i.e. | ipa ) and | (pa ) are identified as 
the letter 'a', etc. Thus, if Bob initially made n detections, he ends up 
with n/2 quarts, which is, in terms of information contents, equivalent 
to n bits. This key can now directly be used to encode a secret message 
using the One Time Pad. Note that the One Time Pad is not restricted 
to bits, but that any alphabet can be used, see e.g. fl]]. 

2.2 Eavesdropping — Intercept /resend 

During the public discussion Alice and Bob extract a subset of data 
which is compared in public. This discussion leads to an estimate of the 
error rate induced by the presence of an eavesdropper. The data revealed 
during the discussion is afterwards discarded. 

The simplest possible eavesdropping strategy is the intercept /resend 
strategy, in which Eve (the eavesdropper) intercepts the transmissions 
from Alice to Bob, performs a measurement and, according to the out- 
come of her measurement, she prepares a new state and sends it on to 
Bob. In the following only the cases where Alice and Bob use the same 
basis are considered, since the ones where they use different bases are 
discarded during the public discussion. 

Suppose Alice sends the state \ipa)- If Eve performs her measurement 
in the ■0— basis she will find the state | ipa ) and she will prepare a new 
I ipa ) state and send it to Bob. Hence Eve introduces no errors and Bob 
finds the correct state. If instead Eve measures in the 0— basis, she will 
with equal probability, 1/4, find one of the four different 0— states and 
pass it on to Bob. For any of the 0— states Bob will only find the correct 
state, \ipa), with probability 1/4 — which means that with probability 
3/4 he will get the wrong state, hence an error. 

For the following discussions it is convenient to introduce a more 
formal measure of information. The relevant information measure here 
is Shannon Information |T^ which by tradition is measured in terms of 



bits. The Shannon information is for qubits bounded between and 
1 bit, since each qubit can carry one bit of information. Whereas for 
the qu-quarts the Shannon information is bounded between and 2 
bits since each qu-quart can carry two bits of information. To obtain 



bits of course means obtaining no information, and 1 bit or 2 bits, 
respectively, means having full information. The general form of the 
Shannon information is 

J ^ i 1 + H{pi,..,pn) for qubits ,^. 

\ 2 + H{pi, ..,pn) for qu — quarts 
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where H{pi, ..,pn) is the entropy function defined as H{pi,..,p„ 
Pilog2Pi + ■ • • + Pn^og2Pn, and pi, ..pn is the probability distribution 
of the possible outcomes l...n. 

Above it was argued that the eavesdropper learns correctly half of 
the transmissions when using the intercept /resend strategy. The formal 
definition of Shannon information leads for the qu-quart case to 

II = |[2 + llog2l + 01og20 + 01og20 + 01og20] + 

I [ 2 + ilog2 i + il0g2 i + |l0g2 \ + il0g2 I ] (4) 

= 1 

as expected, since half of the times Eve learns 2 bits and half of the times 
she learns bits, leading to an average of 1 bit — half of the transferred 
information. 

Calculating Eve's amount of Shannon information for the qubit case 
leads to 

/| = i[l + llog2l + 01og20] + |[l + ilog2i + |log2|] ^^^ 

~ 2 

This means that also in the qubit case the eavesdropper learns on aver- 
age only half of the transfered information, however, she will introduce a 
smaller error rate of only one out of four transmissions 0. To conclude, 
the eavesdropper gains the same fraction of information whether using 
qu-quarts or qubits, however the qu-quarts do hold an advantage for Al- 
ice and Bob, since the eavesdropper introduces a higher error rate — 3/8 
compared to 1/4 — in order to obtain the same amount of information 
|I^. From now on, we will refer to the quantum error rate in the general 
case as quantum transmission error rate QTER. 

2.2.1 The intermediate basis 

As in the qubit case Eve may also chose to perform her measurement 
in what is known as the intermediate basis, instead of using the same 
bases as Alice and Bob 0. Eavesdropping in the intermediate basis 
is the simplest example of an eavesdropping strategy which gives the 
eavesdropper probabilistic information. 

In the extended BB84 protocol the intermediate 6— basis is defined 
with the following requirements 

\{9i\ipi)\ = \{6i\(j)i)\= max value , , 

I ( ^j I "^i ) I = \{^i\4'j)\ = ^^ value, for alH 7^ j 



The two vectors | ipi ) and | (pi ) define a plane. The vector which gives 
the same maximum overlap, is the one with the same minimum distance 
to both of them, which is 
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|^,) = iV(|^,) + |0,)) (7) 

where N is the normalization constant. This argument leads to the 
following intermediate basis 
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I ^" ) = ^ ( 3| ^a ) + I ^/3 ) + I V^7 ) + I ^5 ) ) 

which satisfy \{0i\0j)\ = Sij and which has the following overlaps 

Assume that Alice sends the state | ipa ) and Eve measures in the 
intermediate basis, i.e. the ^— basis, then she will find the following out- 
comes with the corresponding probabilities: P{Oa) = 3/4 and P{d/3) = 
P{0.y) = P{0s) = 1/12. These probabilities give Eve the following Shan- 
non information 

J| = ( 2 + ^ log2 ^ + 3^ log2 ^ ) ^ 0.792 (10) 

and she will give rise to the following error rate: with probability 3/4 
Eve will send to Bob the state | 6a) and with probability 1/12 she will 
send him \Ofs), \6^) or \6s)- Which gives Bob the following probability 
of finding the correct state (remember that Alice sent \ipa), and it is 
assumed that Bob measures in the ■?/'— basis) || + 3(^^) = |. Which 
means that even if Eve measures in the intermediate basis she will in- 
troduce the same error rate, namely 3/8. 

Comparing this strategy on the qu-quarts with the equivalent strategy 
on qubits; In the qubit case Eve has probability P{s) = "^'^^ ~ 0.146 
for successfully identifying the state, leading to an amount of Shannon 
information of 

4 = ( 1 + (^) log2(2^) + (1 - ^) log2(l - 2^) ) ^ 0.399 (11) 

and an QBER of 1/4. To compare the information gained by the eaves- 
dropper in the two cases, we have to consider how much information 
she has on the whole string. Suppose that Alice has sent n qu-quarts, 
then Eve has 0.792n bits of information on the whole string. In order to 
transmit the same amount of information to Bob using qubits, Alice has 
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to send 2n qubits since each qubit carries half the amount of informa- 
tion of a qu-quart. This means that in the qubit case Eve would obtain 
2n X 0.399 = 0.798n bits of information. Again this shows that in the 
case of a larger alphabet the eavesdropper will introduce a higher error 
rate — the same as in the case treated before (2.2) — - in order to get a 
comparable amount of information. The issue of optimal eavesdropping 
on the higher alphabet will be discussed in a forthcoming paper |^ . 



2.3 Mapping onto a two-dimensional key 

Classically a larger alphabet like the one used here, may simply be viewed 
as an encoding of bits, for example a = 00, /3 = 01, 7 = 10 and 6 = 11. 
Alice and Bob can also in this case chose to view the higher alphabet as a 
simple encoding of bits. However, the following example shows that they 
have to be careful about when they perform the translation. Suppose 
that the eavesdropper has used the intermediate basisQ, then she will 
have obtained each quart correctly with probability 3/4. This means 
that on average Eve will have 3 out of 4 quarts correctly — however she 
does not know which ones she has correctly and which ones are wrong. 
Now suppose that Alice has sent the following string of a, /3, 7 and 6: 

Alice : a6i3a'y66P'yaP 6... 

but that Eve has the string 

Eve : aS^yajPSPjaa 5... 

It is easily seen that 3 out of 12 are wrong in Eve's string or that she 
has 9/12 = 3/4 correct. 

Assume now that Alice and Bob want to map the 4-dimensional key 
onto a binary one. Using the above given example, Alice's new string 
reads 

Alice : 00 11 01 00 10 11 11 01 10 00 01 11... 

Doing the same with her sequence of quarts. Eve ends up with 

Eve : 00 11 10 00 10 01 11 01 10 00 00 11... 

Notice that here Eve has 4/24 = 1/6 bits wrong or 5 out of 6 bits correct. 
This is due to the fact that the errors occurring in Eve's string are no 
longer independent, but depend on each other in the respective blocks. 
Beyond, the processes of error correction and privacy amplification do 
not apply to this case. This means that Alice and Bob have to perform 



^The same can not be illustrated considering the eavesdropping strategy where Eve use the 
same basis as Alice and Bob, since in that case she has either full information about the quart sent 
by Alice or no information at all. 



this process in the higher alphabet, and only perform the translation to 
bits at the very end when the eavesdropper has no information on the 
string shared between them. 

It is important to realize that Alice and Bob should not even dis- 
cuss how the translation should be done until after error correction and 
privacy amplification, since this information may give an advantage to 
the eavesdropper. Assume that Alice and Bob before starting the trans- 
missions of qu-quarts have decided for the bit-encoding which is given 
above. In designing the optimal eavesdropping strategy. Eve may use 
this knowledge to give different weight to the various states. Suppose, 
for example, Alice sends an a. Eve will with the highest possible prob- 
ability try to identify that Alice sent an a, since in that case she has 
learned both bits correctly. Failing to make the correct identification, 
and instead obtaining /3 or 7 will however still give her one bit correct, 
whereas finding 5 gives her only errors. As a consequence Eve will give 
more weight to (5 and 7, than to b. However, this is very different from 
eavesdropping on the higher alphabet, where obtaining a is correct, but 
any other letter /?, 7 or 5 is equally wrong. 

3 Experimental realization 

In the following, the given states are given physical meaning and a pos- 
sible experimental realization for a four-letter alphabet is presented. It 
is important to notice that generalization to arbitrarily large alphabets 
is in principle possible. 

Alice is in possession of an apparatus (see fig.l) that allows her to 
route an incoming photon (or faint laser pulse) emitted at time tg to one 
of four different delay lines. This task can be accomplished by using an 
optical switch. Using another switch, the light traveling via the chosen 
delay line is then injected (at times ta,..,ts) into the output port of the 
device. This apparatus thus allows Alice to create single photons in four 
different time slots which we identify with the states \ipa),- ■ ■ Ai^s)- To 
distinguish the four states of the tp- or time-basis, it suffices to measure 
the arrival time of the photons with respect to to- Bobs analyzer thus 
simply consists of a photon detector and a fast clock. 

In order to create one of the four states belonging to the (p- or energy- 
basis, Alice has to prepare a coherent superposition of the four emission 
times with appropriate phase differences. Hence, the first switch in the 
preparation device has to be replaced by a symmetric 1x4 optical cou- 
pler. Using the coupler depicted in Figure 2 |l^ and phases a^, ■ ' ' ; ^a, 



it is not difficult to show that it is possible to create the desired states 
I 0Q, ), ■ ■ ■ , I 0^). For instance, choosing aA= 0, /3A=vr/2, 7^= and 
6a= — 7r/2 leads (neglecting an unimportant overall phase) to creation 



of I 0Q, ) ||T6l . In order to distinguish the four states of the energy basis. 



Bob has to have a device that coherently recombines the pulses arriv- 
ing at times ta,---,ts and then makes them interfere in such a way, 
that each state leads to completely constructive interference in specific 
output port, hence to a detection by a different detector. The device 
thus consists of an optical switch that routes the pulse arriving first to 
a long delay line, the pulse arriving second to a shorter one etc. in a 
way, that the delay difference introduced by Alice will be exactly com- 
pensated. Using the already mentioned 4x4 coupler and phase settings 
aB = 0,i3b = —T^I'^ilB = and 5b = 7r/2, it is straightforward to show 
that each state indeed leads to detection in a different detector (i.e., | (pa ) 
leads to detection in Dn etc). 



4 Discussion and experimental extensions 

As stated in the introduction, one of the motivations for considering 
higher dimensional systems for QKD is the increase of information per 
photon. This leads after error correction and privacy amplification of 
the high-dimensional (more-then-two-dimensional) key to a larger binary 
key. Beyond, the important point of our proposal is that the mentioned 
speedup goes along with an increasing quantum transmission error rate 
introduced by eavesdropping. Unfortunately, this advantage of easier 
detection of an unlegitimized third person is somewhat hidden by a 
higher QTER introduced by Alice and Bob themselves. That is, the 
larger number of simultaneously active (and noisy) detectors engenders 
a higher probability that one detector sees a dark count while a photon is 
expected to arrive. However, we believe that as long as those errors are 
small, QKD using higher alphabets could still be advantageous compared 
to two-level systems. 

Attention should be drawn to several interesting extensions of this 
proposal. First of all, similar to QKD schemes based on two-level sys- 



tems, it is possible to find a "plug&play" system ||T3 using time multi- 
plexed interferometry to realize systems of higher dimensions as well, the 
advantage being that there is no need to equalize the path differences of 
different interferometers. Second, our proposal can easily be extended 
to photon correlation experiments as well (for proposals in the domain 



of fundamental physics, see i.e. []TU|, |TT|). To give an example, higher 



dimensional secret sharing |T^ could be realized in the following way. 
One could pump a nonlinear crystal with a laser pulse, having traveled 
via one out of n delay lines, or a coherent superposition of n delay hues, 
respectively. Similar to the here treated case, the created photon pair 
would then be described either in a time, or an energy basis. After hav- 
ing separated the two photons, each one is then analyzed in one of the 
two bases (in this context, see |jl9|, |20|). 



5 Conclusion 

We proposed to enlarge the dimensions of quantum systems for quan- 
tum key distribution and analyzed a protocol based on four orthogonal 
states in two different bases in terms of information transfer and intro- 
duced errors by an intercept /resend eavesdropping attack. Since every 
particle now carries more information, we find an increased flux of infor- 
mation which can be turned into an increased binary key creation rate. 
Beyond, the quantum transmission error rate introduced by an eaves- 
dropper for a given amount of acquired information is much higher then 
in the qubit case. Furthermore we proposed an experimental realization 
using an interferometric setup. Even if the quantum transmission error 
rate introduced by the noise of the detectors is higher than in the qubit 
case, the new protocol will still be advantageous compared to two-level 
systems as long as these errors are small. 

Besides these more practical considerations, the most important point 
of our proposal is that, in opposition to its classical counterpart, quantum 
information theory, at least quantum key distribution, changes when 
passing from two dimensional to higher dimensional systems. We thus 
believe that it might be interesting to consider other applications from 
this the point of view as well. 
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Figure 1: Schematical setup for four- letter quantum key distribution. See text for 
detailed description. 
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Figure 2: Bulk- and fiber optical realization of a symmetric 4x4 coupler. 
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